Network intrusion detection method and network intrusion detection device based on deep learning

Abstract

The invention provides a network intrusion detection method and a network intrusion detection device based on deep learning, and the method comprises the steps: sequentially inputting the input data in multiple groups of current training data into a convolutional neural network layer, a gating time sequence convolutional network layer and an attention mechanism layer of a network intrusion detection model, so as to obtain sample target feature data; outputting a corresponding sample traffic data type through the full connection layer; performing model verification according to all the sample flow data types to obtain model precision; under the condition that the model precision does not meet the precision requirement, all parameters in the network intrusion detection model are adjusted until the model precision meets the precision requirement, and a target network intrusion detection model is obtained; and inputting the network traffic data into the target network intrusion detection model, and outputting to obtain a real-time traffic data type. The problem of low network intrusion detection precision caused by the fact that time features and space features are not combined to extract important feature information during network intrusion detection in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of network intrusion detection, and in particular to a network intrusion detection method based on deep learning, a network intrusion detection device, a computer-readable storage medium, and a computer program product. Background Art

[0002] The widespread application of information technology and the rise and development of cyberspace have greatly promoted economic and social prosperity and progress, but have also brought new cyberspace security risks and challenges. With the increasing perfection of computer networks and communication networks, cyberspace security faces complex and diverse security threats such as network intrusions and attacks. Network intrusion detection is an important security defense technology in cyberspace security, which is used to monitor and detect security incidents. By analyzing the characteristics of network traffic data, network malicious behaviors can be discovered and detected, and reasonable defense strategies can be formulated to ensure network and data security. According to the requirements of cyberspace security protection, it is necessary not only to quickly detect network intrusions in network traffic data, but also to accurately identify the specific categories of network intrusions, so as to adopt targeted defense strategies and response disposal to ensure network security. Network intrusion detection has been a hot research topic in the field of cyberspace security in recent years. With the explosive growth of network traffic, it has become crucial to design an efficient and robust network intrusion detection system in a big data environment, but it is also difficult. Therefore, it is of great significance to study fast and accurate intelligent network intrusion detection methods to defend against various network intrusions in complex network environments.

[0003] Traditional network intrusion detection systems can be divided into misuse detection and anomaly detection. Misuse detection determines whether data is an intrusion by matching rules or features, and anomaly detection determines whether data is anomaly by anomaly. However, both methods have the disadvantages of low detection rate and high false alarm rate. Researchers use machine learning and deep neural models to improve the network intrusion detection results of intelligent systems. In the early days of network intrusion detection, traditional machine learning was often used to study how to make predictions for a single model. However, the prediction accuracy obtained from a single model is very limited. K-nearest neighbor algorithm, naive bays algorithm, decision tree algorithm, random forest algorithm and other algorithms have been used in network intrusion detection. Although these techniques are simple and do not require much training, their accuracy is low. Compared with network intrusion detection built using traditional machine learning methods, network intrusion detection built using deep learning has higher accuracy. For example, multi-layer perceptron (MLP), convolutional neural network (CNN), recurrent neural network (RNN), long short-term memory (LSTM) and other related algorithms are used for network intrusion detection. Although these algorithms make network intrusion detection more accurate, they take a long time to train.

[0004] Network intrusion detection based on machine learning and deep learning focuses on model performance rather than semantic analysis of network data. The general network intrusion detection scenario is that network intrusion detection examines network traffic and hosts to identify possible intrusions. The system is linked to network nodes, such as hubs or switches, so that network activities can be tracked. Network intrusion detection monitoring points are placed in high-traffic areas of the network to check data packets for signs of bad behavior. Attackers may use multiple malicious scripts to damage target devices. In terms of behavioral segmentation, semantic-based feature analysis can reveal potentially destructive scripts. Before network data is fed into a deep learning model, it can be semantically analyzed to extract training features. For semantic analysis, detailed information for each attack type can be combined with other features, such as host information, attack name, and attack reference. Overall, each security feature provides only a limited view of security threats and usually focuses on only one type of attack. In addition, the ability of various features to distinguish abnormal activities varies greatly. Therefore, most existing network intrusion detection methods collect the full picture by using multiple features instead of just one type. In addition, attackers use existing experience related to features to create intrusion variants to avoid detection, and new feature sets need to be developed to supplement existing knowledge and expand the feature combination space, which makes it more difficult for intruders to avoid detection. Summary of the invention

[0005] The main purpose of the present application is to provide a network intrusion detection method, a network intrusion detection device, a computer-readable storage medium and a computer program product based on deep learning, so as to at least solve the problem in the prior art that the network intrusion detection accuracy is low due to the failure to combine the time features and the spatial features to extract important feature information during the network intrusion detection.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a network intrusion detection method based on deep learning is provided, comprising: a first extraction step, inputting the input data in multiple groups of current training data into the convolutional neural network layer of the network intrusion detection model in sequence, so as to use the convolutional neural network layer to extract the spatial features of the training data to obtain sample spatial features, the current training data is any group of training data in the training data set, the training data set includes multiple groups of the training data, each group of the training data includes the input data and output data, the input data is sample network traffic data, the output data is the sample traffic data type corresponding to the sample network traffic data, and the sample traffic data type includes abnormal traffic and normal traffic; a second extraction step, inputting the sample spatial features into the gated temporal convolutional network layer of the network intrusion detection model, so as to use the gated temporal convolutional network layer to extract the temporal features of the sample spatial features to obtain sample temporal features; a fusion step, fusing the sample spatial features and the sample temporal features to obtain fused feature data, and inputting the fused feature data into the attention mechanism layer of the network intrusion detection model to use the attention mechanism layer to re-extract features , obtain sample target feature data, the attention mechanism layer is used to assign different weights to the sample spatial features and the sample time features in the fused feature data; an output step, reshape the sample target feature data through the dimension reshaping layer of the network intrusion detection model, and output the corresponding sample traffic data type through the fully connected layer of the network intrusion detection model; a verification step, perform model verification according to all the sample traffic data types to obtain model accuracy, the model verification at least includes calculating the accuracy, detection rate and false alarm rate of the network intrusion detection model for intrusion detection, and the model accuracy at least includes the accuracy, detection rate and false alarm rate; when the model accuracy does not meet the accuracy requirements, adjust all parameters in the network intrusion detection model, and repeat the first extraction step, the second extraction step, the fusion step, the output step and the verification step at least once until the model accuracy meets the accuracy requirements, and obtain the target network intrusion detection model; obtain network traffic data in real time, input the network traffic data into the target network intrusion detection model, and output the real-time traffic data type; when the real-time traffic data type is abnormal traffic, perform exception processing.

[0007] Optionally, before inputting the input data in multiple groups of current training data into the convolutional neural network layer of the network intrusion detection model in sequence to extract the spatial features of the training data using the convolutional neural network layer to obtain sample spatial features, the method also includes: obtaining a sample data set; performing classification feature conversion on all data in the sample data set to obtain initial sample network traffic data, so that the initial sample network traffic data meets the input format requirements of the convolutional neural network layer; and standardizing the initial sample network traffic data to obtain the sample network traffic data, wherein the mean of the sample network traffic data is zero and the standard deviation is 1.

[0008] Optionally, the input data in multiple groups of current training data are sequentially input into the convolutional neural network layer of the network intrusion detection model, so as to use the convolutional neural network layer to extract the spatial features of the training data and obtain sample spatial features, including: converting the sample network traffic data in the current training data into a first feature map through a set of filters, wherein the first feature map is the spatial features of the sample network traffic data initially extracted; performing a nonlinear transformation on the first feature map using an activation function to obtain a second feature map; performing a pooling operation on the second feature map to obtain the sample spatial features, wherein the pooling operation is used to reduce the spatial dimension of the second feature map.

[0009] Optionally, before inputting the sample space feature into the gated temporal convolutional network layer of the network intrusion detection model to extract the time feature of the sample space feature using the gated temporal convolutional network layer to obtain the sample time feature, the method further includes: performing batch normalization processing on the sample space feature according to a first formula to obtain the normalized sample space feature, wherein the first formula is: The normalized sample space feature x is the sample space feature before adjustment, μ B represents the mean, δ B represents the variance, ε is a negligible value used to ensure that the denominator in the formula is not zero; the normalized sample space feature is calculated using the second formula to obtain the adjusted sample space feature, so as to input the adjusted sample space feature into the gated temporal convolutional network layer, and the second formula is Both β and γ are trainable parameters.

[0010] Optionally, the fused feature data is input into the attention mechanism layer of the network intrusion detection model to use the attention mechanism layer to re-extract features to obtain sample target feature data, including: multiplying the fused feature data with three different linear matrices to obtain a query vector matrix, a key vector matrix and a value vector matrix, respectively, the query vector matrix is ​​used to represent the position of the data features in the fused feature data, the key vector matrix represents the correlation between the current data features and other data features, and the value vector matrix represents the data features; the weight of each of the data features in the fused feature data is calculated according to a third formula, and the third formula is Attention(Q, K, V) represents the weight, Q represents the query vector matrix, K represents the key vector matrix, V represents the value vector matrix, T represents the probability distribution, The vector dimension F representing the query vector moment Q k The square root of ; Select the data feature corresponding to the weight greater than the weight threshold and determine it as the sample target feature data.

[0011] Optionally, the sample target feature data is reshaped through the dimension reshaping layer of the network intrusion detection model, and the corresponding sample traffic data type is output through the fully connected layer of the network intrusion detection model, including: determining a target output dimension, the target output dimension being the input dimension of the next layer of the dimension reshaping layer; performing a reshaping operation on the sample target feature data according to the target output dimension to rearrange the elements of the sample target feature data to obtain sample traffic data; and processing the sample traffic data through the fully connected layer to generate the sample traffic data type.

[0012] Optionally, performing a model verification operation according to all the sample flow data types to obtain the model accuracy includes: calculating the accuracy using a fourth formula according to all the sample flow data types, the fourth formula being: ACC represents the accuracy, TP is the number of attacks actually received by the network, TN is the number of correctly classified normal flows, FP is the number of actually normal flows but misclassified as abnormal flows, and FN is the number of attacks misclassified as normal flows; the detection rate is calculated using the fifth formula based on all the data types of the sample flows, and the fifth formula is: DR is the detection rate, which is used to represent the detection capability of the network intrusion detection model; the false alarm rate is calculated using the sixth formula according to all the sample traffic data types, and the sixth formula is: FPR is the false alarm rate; when the accuracy is greater than or equal to the first threshold, the detection rate is greater than or equal to the second threshold, and the false alarm rate is greater than or equal to the third threshold, it is determined that the network intrusion detection model meets the accuracy requirement; when the accuracy is less than the first threshold, the detection rate is less than the second threshold, or the false alarm rate is less than the third threshold, it is determined that the network intrusion detection model does not meet the accuracy requirement.

[0013] According to another aspect of the present application, a network intrusion detection device based on deep learning is provided, the device comprising: a first extraction unit, used to perform a first extraction step, inputting input data in multiple groups of current training data into a convolutional neural network layer of a network intrusion detection model in sequence, so as to use the convolutional neural network layer to extract spatial features of the training data to obtain sample spatial features, the current training data is any group of training data in a training data set, the training data set includes multiple groups of the training data, each group of the training data includes the input data and output data, the input data is sample network traffic data, and the output data is the sample The sample traffic data type corresponding to the network traffic data, the sample traffic data type includes abnormal traffic and normal traffic; a second extraction unit, used to perform a second extraction step, input the sample space feature into the gated temporal convolutional network layer of the network intrusion detection model, so as to use the gated temporal convolutional network layer to extract the time feature of the sample space feature, and obtain the sample time feature; a fusion unit, used to perform a fusion step, fuse the sample space feature and the sample time feature, obtain fused feature data, and input the fused feature data into the attention mechanism layer of the network intrusion detection model, so as to facilitate the attention mechanism layer to re-enter the network intrusion detection model; The method comprises the following steps: extracting features of the network intrusion detection model and obtaining sample target feature data, wherein the attention mechanism layer is used to assign different weights to the sample spatial features and the sample temporal features in the fused feature data; an output unit is used to execute the output step, reshape the sample target feature data through the dimension reshaping layer, and output the sample traffic data type through the fully connected layer; a verification unit is used to execute the verification step, perform model verification according to all the sample traffic data types, and obtain model accuracy, wherein the model verification at least includes calculating the accuracy, detection rate and false alarm rate of the network intrusion detection model for intrusion detection, and the model accuracy at least includes the accuracy, detection rate and false alarm rate; a repetition unit is used to adjust all parameters in the network intrusion detection model when the model accuracy does not meet the accuracy requirement, and repeatedly execute the first extraction step, the second extraction step, the fusion step, the output step and the verification step at least once until the model accuracy meets the accuracy requirement, and obtain the target network intrusion detection model; a real-time detection unit is used to obtain network traffic data in real time, input the network traffic data into the target network intrusion detection model, and output the real-time traffic data type; a processing unit is used to perform exception processing when the real-time traffic data type is abnormal traffic.

[0014] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the methods described.

[0015] According to another aspect of the present application, a computer program product is provided, comprising computer instructions, wherein when the computer instructions are executed by a processor, any one of the methods described above is implemented.

[0016] Applying the technical solution of the present application, in a network intrusion detection method based on deep learning, by integrating a convolutional neural network (CNN), a gated temporal convolutional network (GatedTemporalConvolutional Network, GatedTCN) and a recurrent neural network (RNN), and adding an attention mechanism layer after it, and finally learning synchronously in multiple steps. Since CNN can extract high-level features from a large amount of data, CNN is placed before the GatedTCN and RNN networks, and the CNN output will still retain the time information, which is then captured by the GatedTCN and RNN networks. Finally, the attention mechanism layer can use the attention mechanism to "dynamically" generate weights of different connections, so it can be used to process variable-length input sequences. As the data processing proceeds to the next step, the learning granularity becomes finer. By integrating learning in this way, CNN, RNN, GatedTCN and the attention mechanism layer can fully learn without interfering with each other. The present application solves the problem that the network intrusion detection accuracy is low due to the failure to combine the time features and the spatial features to extract important feature information during the prior art network intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A hardware structure block diagram of a mobile terminal for executing a network intrusion detection method based on deep learning provided in an embodiment of the present application is shown;

[0018] Figure 2 A schematic diagram of a process of a network intrusion detection method based on deep learning provided according to an embodiment of the present application is shown;

[0019] Figure 3 A connection relationship diagram of CNN and RNN in the prior art provided according to an embodiment of the present application is shown;

[0020] Figure 4 A structural diagram of a network intrusion detection model based on deep learning provided according to an embodiment of the present application is shown;

[0021] Figure 5 A structural block diagram of a deep learning-based network intrusion detection device provided according to an embodiment of the present application is shown.

[0022] The above drawings include the following reference numerals:

[0023] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0024] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] As introduced in the background technology, most of the existing network intrusion detection methods in the prior art collect the whole picture by using multiple functions instead of just one type. In addition, attackers use existing experience related to functions to create intrusion variants to avoid detection, and it is necessary to develop new feature sets to supplement existing knowledge and expand the feature combination space, which makes it more difficult for intruders to avoid being discovered. In order to solve the problem that the network intrusion detection in the prior art does not combine time features and spatial features to extract important feature information, resulting in low network intrusion detection accuracy, the embodiments of the present application provide a network intrusion detection method based on deep learning, a network intrusion detection device, a computer-readable storage medium and a computer program product.

[0028] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0029] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure block diagram of a mobile terminal of a network intrusion detection method based on deep learning according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0030] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the display method of device information in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0031] In this embodiment, a deep learning-based network intrusion detection method running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] Figure 2 : is a flow chart of a network intrusion detection method based on deep learning according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0033] Step S201, the first extraction step, sequentially inputs the input data in multiple groups of current training data into the convolutional neural network layer of the network intrusion detection model, so as to utilize the above convolutional neural network layer to extract the spatial features of the above training data and obtain sample spatial features, wherein the above current training data is any group of training data in the training data set, and the above training data set includes multiple groups of the above training data, and each group of the above training data includes the above input data and output data, the above input data is sample network traffic data, and the above output data is the sample traffic data type corresponding to the above sample network traffic data, and the above sample traffic data type includes abnormal traffic and normal traffic.

[0034] Specifically, CNN targets spatial features, while RNN targets temporal features. Existing research work HAST-IDS simply connects CNN and RNN in series, such as Figure 3 As shown in Figure 2, when learning is performed along multiple levels of the CNN hierarchy, the extracted information becomes more space-oriented. Temporal features may be lost by the CNN hierarchy, which significantly limits the learning effect of the subsequent RNN (LSTM). To address the above problems, the above embodiment integrates CNN, Gated TCN and RNN subnetworks, and then adds Self-Attention, and finally learns synchronously in multiple steps, as shown in Figure 2. Figure 4 As shown in the figure. Since CNN can extract high-level features from a large amount of data, CNN is placed before the Gated TCN and RNN network. The input data in multiple sets of current training data are first input into the convolutional neural network layer of the network intrusion detection model in sequence, so as to use the convolutional neural network layer to extract the spatial features of the training data and obtain the sample spatial features. At the same time, the CNN output will still retain the time information.

[0035] Step S202, a second extraction step, inputs the sample space feature into the gated temporal convolutional network layer of the network intrusion detection model, so as to extract the time feature of the sample space feature using the gated temporal convolutional network layer to obtain the sample time feature.

[0036] Specifically, Gated TCN is very important in recurrent neural networks. It can control the information of each layer in the temporal convolutional network (TCN). Given an input X∈R N×D×S , which is in the form of: h = g(θ1*X+b)⊙σ(θ2*X+c), where θ1, θ2, b and c are model parameters, ⊙ represents element-wise product, g(.) is the activation function of the output, and σ(.) is the sigmoid function, which determines the ratio of information passed to the next layer. Use dilated casual convolution as TCN to capture features. The dilated causal convolution network achieves a larger receptive field by increasing the depth of the layer, facilitates parallel computing, and alleviates the gradient vanishing problem. The dilated causal convolution maintains the temporal causal order by padding the input with zeros. As a special case of the standard 1D convolution, the dilated causal convolution operation slides the input by skipping values ​​in specific steps. Mathematically, given a one-dimensional sequence input x∈R T and filter f∈R K , the dilated causal convolution operation of x and f at step t is represented as As shown, d is the scaling factor that controls the jump distance. Unlike CNN, which learns information based on individual data records, RNN can establish relationships between data records by feeding back the learning of the previous learning to the current learning, so that the temporal features in the input data can be captured. However, the simple feedback used in traditional RNNs may accumulate learning errors in long-term dependencies. The accumulated errors may become large enough to invalidate the final learning results. LSTM is a gated recurrent neural network that alleviates such problems. It controls feedback through a set of gate functions so that short-term errors are eventually eliminated and only persistent features are retained. Therefore, LSTM is used for RNN. LSTM can be abstracted as a connection of four subnetworks, a set of control gates and a memory component. The input and output values ​​in the figure are vectors of the same size determined by the input x(t). The state s(t) stored in the memory serves as feedback for the current learning, which is specifically expressed as follows: s(t) = b + U × x(t) + W × h(t-1), where x(t), h(t-1), b, and U are the input at time t, the output at time t-1, the bias, and the weight matrix, respectively. Using the subnet (p(t), g(t), f(t), q(t)), the feedback s(t) from previous learning and the current output h(t) are determined through two types of control gates (α, tanh), namely the forget gate and the input gate. It is specifically expressed as follows: s(t) = σ(.f(t))*s(t-1)+σ(p(t))*tanhg(t), h(t) = tanhs(t)*σ(q(t)). LSTM learns the input by adjusting the weights and σ values ​​in these networks so that the temporal features between the input data can be effectively generated in the output.

[0037] Step S203, a fusion step, fuses the above-mentioned sample space features and the above-mentioned sample time features to obtain fused feature data, and inputs the above-mentioned fused feature data into the attention mechanism layer of the above-mentioned network intrusion detection model to use the above-mentioned attention mechanism layer to re-extract features to obtain sample target feature data. The above-mentioned attention mechanism layer is used to assign different weights to the above-mentioned sample space features and the above-mentioned sample time features in the above-mentioned fused feature data.

[0038] Specifically, the features extracted by CNN, GatedTCN and RNN are fused to obtain fused features. In order to better express useful input information, Self-Attention is introduced to assign different weights to the fused features, so that the spatial and temporal features of the data can be effectively extracted. The introduction of the attention mechanism can select more important parts from a large amount of information, which is conducive to improving the accuracy of intrusion detection, because self-attention can reduce the influence of external information and perform secondary feature extraction to select important feature information.

[0039] Step S204, an output step, reshapes the sample target feature data through the dimension reshaping layer of the network intrusion detection model, and outputs the corresponding sample traffic data type through the fully connected layer of the network intrusion detection model.

[0040] Specifically, in order to ensure that the input of each layer in the network intrusion detection model is in the expected input format, it is necessary to use the dimension reshaping layer to reshape the above sample target feature data, and reshape the output of the previous layer to meet the input data dimension of the current layer. Finally, the fully connected layer is used to output the result of the model. The result of the model is the above sample traffic data type.

[0041] Step S205, a verification step, performs model verification based on all of the above sample traffic data types to obtain model accuracy. The above model verification at least includes calculating the accuracy, detection rate and false alarm rate of the above network intrusion detection model for intrusion detection. The above model accuracy at least includes the above accuracy, detection rate and false alarm rate.

[0042] Specifically, the network intrusion detection model is evaluated based on the verification accuracy (ACC), detection rate (DR) and false positive rate (FPR).

[0043] Step S206, when the accuracy of the above-mentioned model does not meet the accuracy requirements, all parameters in the above-mentioned network intrusion detection model are adjusted, and the above-mentioned first extraction step, the above-mentioned second extraction step, the above-mentioned fusion step, the above-mentioned output step and the above-mentioned verification step are repeated at least once, until the accuracy of the above-mentioned model meets the above-mentioned accuracy requirements, and the target network intrusion detection model is obtained.

[0044] Specifically, when any one of the accuracy (ACC), detection rate (DR) and false alarm rate (FPR) does not meet the requirements, all parameters in the above network intrusion detection model are adjusted, and the network intrusion detection model is retrained until the accuracy of the above model meets the above accuracy requirements, thereby obtaining the target network intrusion detection model.

[0045] Step S207, acquiring network traffic data in real time, and inputting the network traffic data into the target network intrusion detection model, and outputting a real-time traffic data type.

[0046] Specifically, after the network intrusion detection model is trained, it can be deployed on the system for real-time detection, and the current network traffic data can be obtained in real time. The above network traffic data is input into the above target network intrusion detection model, and the current real-time traffic data type is output to determine whether the current real-time traffic data type is abnormal traffic or normal traffic.

[0047] Step S208: When the type of the real-time traffic data is abnormal traffic, perform abnormal processing.

[0048] Specifically, when the type of the real-time traffic data is abnormal traffic, it indicates that the current network has been invaded or attacked, and the abnormal network needs to be processed.

[0049] In this embodiment, by integrating CNN, Gated TCN and RNN subnets, and adding an attention mechanism layer after them, finally learning synchronously in multiple steps. Since CNN can extract high-level features from a large amount of data, CNN is placed before GatedTCN and RNN networks. The CNN output will still retain the time information, which is then captured by the Gated TCN and RNN networks. Finally, the attention mechanism layer can use the attention mechanism to "dynamically" generate weights for different connections, so it can be used to process variable-length input sequences. As the data processing proceeds to the next step, the learning granularity becomes finer. By integrating learning in this way, CNN, RNN, Gated TCN and attention mechanism layers can fully learn without interfering with each other. The present application solves the problem of low accuracy of network intrusion detection in the prior art, which results in the failure to combine temporal features and spatial features to extract important feature information during network intrusion detection.

[0050] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the deep learning-based network intrusion detection method of the present application will be described in detail below in combination with specific embodiments.

[0051] In order to improve the efficiency of deep learning, in an optional implementation manner, before the above step S201, the method further includes:

[0052] Step S301, obtaining a sample data set;

[0053] Step S302, performing classification feature conversion on all data in the sample data set to obtain initial sample network traffic data, so that the initial sample network traffic data meets the input format requirements of the convolutional neural network layer;

[0054] Step S303, standardize the above-mentioned initial sample network traffic data to obtain the above-mentioned sample network traffic data, and the mean value and standard deviation of the above-mentioned sample network traffic data are zero and 1.

[0055] In the above embodiment, the evaluation of the neural network model design is closely related to the data set used. In order to ensure the effectiveness of the evaluation, a non-redundant data set UNSW-NB15 is selected. UNSW-NB15 was generated in 2015. For the data set, attack samples were first collected from three real-world websites: CVE (Common Vulnerabilities and Exposures), BID (Symantec Corporation) and MSD (Microsoft Security Bulletin), and then sample attacks were simulated in a laboratory environment to generate a data set. There are nine attack categories in the UNSW-NB15 data set: DoS, Exploits, Generic, Shellcode, Reconnaissance, Backdoor, Worms, Analysis and Fuzzers. After obtaining the sample data set, the input data needs to be made to conform to the input format required by the neural network, and the original network traffic data includes some classification features. Text information cannot be processed by the deep learning algorithm and needs to be converted into numerical values ​​to obtain the initial sample network traffic data. Therefore, it can be converted by using the "get dummies" function in Pandas. The input data may have different distributions with different means and standard derivatives, which may affect the learning efficiency, therefore, standardization will be applied to scale the initial sample network traffic data so that the initial sample network traffic data has a mean of 0 and a standard deviation of 1.

[0056] In order to extract spatial features while retaining temporal features, in an optional implementation, the above step S201 includes:

[0057] Step S2011, converting the sample network traffic data in the current training data into a first feature graph through a set of filters, wherein the first feature graph is the spatial features initially extracted from the sample network traffic data;

[0058] Step S2012, performing a nonlinear transformation on the first feature map using an activation function to obtain a second feature map;

[0059] Step S2013: performing a pooling operation on the second feature map to obtain the sample space feature. The pooling operation is used to reduce the spatial dimension of the second feature map.

[0060] In the above embodiment, CNN mainly consists of two operations: convolution and pooling. Convolution transforms input data into output that highlights the characteristics of the input data through a set of filters or kernels, so the output is usually called a feature map. The convolution output is further processed by an activation function and then downsampled by pooling to remove irrelevant data. Pooling also helps to eliminate failures in the data to improve the learning of subsequent layers. CNN automatically adjusts the filters to learn the input data through rounds of learning process so that its output feature map can effectively represent the original input data. Since network packets exist in one-dimensional form, the one-dimensional convolution is represented as follows: Among them, i represents the position of each value in the input data (i.e., the sample network traffic data mentioned above), g(j) represents the different distribution values ​​of the j-th value in the above input data, j represents the necessary parameter variable of the convolution formula, which is used to specify the range of convolution, m represents the size of the filter, f represents the filter, and ReLU can be selected as the activation function.

[0061] In order to reduce the covariance shift and improve the stability of the learning result, in an optional implementation manner, before the above step S202, the method further includes:

[0062] Step S401, batch normalization processing is performed on the sample space features according to the first formula to obtain the normalized sample space features. The first formula is: The normalized sample space feature x is the sample space feature before adjustment, μ B represents the mean, δ B represents the variance, ε is a negligible value used to ensure that the denominator in the formula is not zero;

[0063] Step S402, based on the normalized sample space feature, the second formula is used to calculate to obtain the adjusted sample space feature, so as to input the adjusted sample space feature into the gated temporal convolutional network layer. The second formula is: Both β and γ are trainable parameters.

[0064] In the above embodiment, one problem with using a deep neural network is that the input value range changes dynamically layer by layer during training, which is also called covariance shift. Covariance shift causes the learning efficiency of one layer to depend on other layers, making the learning results unstable. In addition, due to covariance shift, the learning rate may be limited to a lower value to ensure that data in different input ranges is effectively learned, which slows down the learning speed. Therefore, Batch Normalization is used to solve this problem. Batch Normalization can be used to adjust the CNN output in the RNN module, as shown in the first formula: Based on normalization Normalization results in the output shown in the second formula, where both β and γ are trained during the learning process to obtain better learning results.

[0065] In order to improve the accuracy of intrusion detection, in an optional implementation manner, the above step S203 includes:

[0066] Step S2031, multiplying the above fused feature data with three different linear matrices to obtain a query vector matrix, a key vector matrix and a value vector matrix respectively, wherein the query vector matrix is ​​used to represent the position of the data features in the above fused feature data, the key vector matrix represents the correlation between the current data features and other data features, and the value vector matrix represents the data features;

[0067] Step S2032, calculating the weight of each of the above data features in the above fused feature data according to a third formula, the above third formula is Attention(Q, K, V) represents the above weights, Q represents the above query vector moment, K represents the above key vector matrix, V represents the value vector matrix, T represents the probability distribution, The vector dimension F represents the query vector moment Q above k The square root of

[0068] Step S2033, selecting the data features corresponding to the weights greater than the weight threshold, and determining them as the sample target feature data.

[0069] In the above embodiment, the combination of CNN, Gated TCN and LSTM network can use CNN for spatial feature extraction and LSTM for time series prediction. The introduction of attention mechanism can select more important parts from a large amount of information, which is conducive to improving the accuracy of intrusion detection. Because self-attention can reduce the influence of external information, the self-attention layer can use the attention mechanism to "dynamically" generate weights of different connections, so it can be used to process variable-length input sequences and can be used as a layer in a neural network. As shown in the third formula, first calculate the dot product of Q and K, and then divide by To prevent the result from being too large, the Softmax operation is used to normalize the result into a probability distribution, and finally multiplied by the matrix V to obtain the weight. The whole process can be understood as dynamically assigning weights to each value vector based on the correlation between the query vector and other key vectors, thereby achieving adaptive attention and feature extraction of the input sequence, and selecting data features with higher weights as the target feature data, that is, the sample feature data mentioned above. This can capture the dependencies between different positions in the input sequence and can handle variable-length input sequences. In practical applications, the attention mechanism layer can be used as a layer in a neural network and used alternately with other layers to improve the model's ability to process sequence data. The attention mechanism layer is Figure 4 Self-Attention in .

[0070] In order to improve the generalization ability of the network intrusion detection model, in an optional implementation manner, the above step S204 includes:

[0071] Step S2041, determining a target output dimension, where the target output dimension is the input dimension of the next layer of the dimension reshaping layer;

[0072] Step S2042, performing a reshaping operation on the sample target feature data according to the target output dimension to rearrange the elements of the sample target feature data to obtain sample flow data;

[0073] Step S2043: Process the sample traffic data through the fully connected layer to generate the sample traffic data type.

[0074] In the above embodiment, since the learning granularity in the network intrusion detection model changes after the output of the CNN+RNN layer, the output size of one level is different from the expected input size of the next level. Therefore, a Dimension Reshape layer is added to adjust the dimension of the data to reshape the input data of the next layer. In addition, a typical problem when using deep neural network learning is overfitting, so it is handled by Dropout. Dropout is a regularization technique that reduces the overfitting problem of the model by randomly discarding the connection of neurons with a certain probability during the training process, which can make the network intrusion detection model more robust and more generalizable. Dropout randomly removes some connections from the deep neural network to reduce overfitting. Finally, an additional convolutional layer and a global average pooling layer are used to further extract spatiotemporal features, and the final learning output is generated by the last fully connected layer, that is, the above sample traffic data is processed by the above fully connected layer to generate the above sample traffic data type.

[0075] In order to accurately evaluate the network intrusion detection model, in an optional implementation manner, the above step S205 includes:

[0076] Step S2051, the accuracy is calculated using the fourth formula according to all the sample flow data types. The fourth formula is: ACC represents the above accuracy, TP is the number of attacks actually received by the network, TN is the number of correctly classified normal traffic, FP is the number of normal traffic that is actually classified as abnormal traffic, and FN is the number of attacks that are incorrectly classified as normal traffic.

[0077] Step S2052, the detection rate is calculated using the fifth formula according to all the above sample flow data types. The fifth formula is: DR is the above detection rate, which is used to indicate the detection capability of the above network intrusion detection model;

[0078] Step S2053, the false alarm rate is calculated using the sixth formula according to all the above sample traffic data types. The sixth formula is: FPR is the false alarm rate mentioned above;

[0079] Step S2054, when the accuracy is greater than or equal to the first threshold, the detection rate is greater than or equal to the second threshold, and the false alarm rate is greater than or equal to the third threshold, determining that the network intrusion detection model meets the accuracy requirement;

[0080] Step S2055: When the accuracy is less than the first threshold or the detection rate is less than the second threshold or the false alarm rate is less than the third threshold, it is determined that the network intrusion detection model does not meet the accuracy requirement.

[0081] In the above embodiment, the network intrusion detection model is evaluated based on verification accuracy (ACC), detection rate (DR) and false alarm rate (FPR). ACC measures the ability of the network intrusion detection model to correctly predict normal traffic that is attacked and not attacked, while DR represents its ability to predict only attacks. A high DR may be masked by a high false alarm rate (FPR), so it needs to be considered together with the DR. The specific calculation formulas are as shown in the fourth formula, the fifth formula and the sixth formula. When any one of the above accuracy, the above detection rate or the above false alarm rate does not meet the accuracy requirement, it is determined that the above network intrusion detection model does not meet the above accuracy requirement, and the network intrusion detection model needs to be retrained.

[0082] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0083] The embodiment of the present application also provides a network intrusion detection device based on deep learning. It should be noted that the network intrusion detection device based on deep learning in the embodiment of the present application can be used to execute the network intrusion detection method based on deep learning provided in the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0084] The following is an introduction to the deep learning-based network intrusion detection device provided in an embodiment of the present application.

[0085] Figure 5 is a structural block diagram of a network intrusion detection device based on deep learning according to an embodiment of the present application. Figure 5 As shown, the device comprises:

[0086] The first extraction unit 10 is used to perform the first extraction step, and sequentially input the input data in multiple groups of current training data into the convolutional neural network layer of the network intrusion detection model, so as to use the above convolutional neural network layer to extract the spatial features of the above training data to obtain sample spatial features, the above current training data is any group of training data in the training data set, the above training data set includes multiple groups of the above training data, each group of the above training data includes the above input data and output data, the above input data is sample network traffic data, the above output data is the sample traffic data type corresponding to the above sample network traffic data, and the above sample traffic data type includes abnormal traffic and normal traffic.

[0087] Specifically, CNN targets spatial features, while RNN targets temporal features. Existing research work HAST-IDS simply connects CNN and RNN in series, such as Figure 3 As shown in Figure 2, when learning is performed along multiple levels of the CNN hierarchy, the extracted information becomes more space-oriented. Temporal features may be lost by the CNN hierarchy, which significantly limits the learning effect of the subsequent RNN (LSTM). To address the above problems, the above embodiment integrates CNN, Gated TCN and RNN subnetworks, and then adds Self-Attention, and finally learns synchronously in multiple steps, as shown in Figure 2. Figure 4As shown in the figure. Since CNN can extract high-level features from a large amount of data, CNN is placed before the Gated TCN and RNN network. The input data in multiple sets of current training data are first input into the convolutional neural network layer of the network intrusion detection model in sequence, so as to use the convolutional neural network layer to extract the spatial features of the training data and obtain the sample spatial features. At the same time, the CNN output will still retain the time information.

[0088] The second extraction unit is used to perform the second extraction step, inputting the above-mentioned sample space features into the gated temporal convolutional network layer of the above-mentioned network intrusion detection model, so as to use the above-mentioned gated temporal convolutional network layer to extract the time features of the above-mentioned sample space features to obtain the sample time features.

[0089] Specifically, Gated TCN is very important in recurrent neural networks. It can control the information of each layer in the temporal convolutional network (TCN). Given an input X∈R N×D×S , which is in the form of: h = g(θ1*X+b)⊙σ(θ2*X+c), where θ1, θ2, b and c are model parameters, ⊙ represents element-wise product, g(.) is the activation function of the output, and σ(.) is the sigmoid function, which determines the ratio of information passed to the next layer. Use dilated casual convolution as TCN to capture features. The dilated causal convolution network achieves a larger receptive field by increasing the depth of the layer, facilitates parallel computing, and alleviates the gradient vanishing problem. The dilated causal convolution maintains the temporal causal order by padding the input with zeros. As a special case of the standard 1D convolution, the dilated causal convolution operation slides the input by skipping values ​​in specific steps. Mathematically, given a one-dimensional sequence input x∈R T and filter f∈R K , the dilated causal convolution operation of x and f at step t is represented as As shown, d is the scaling factor that controls the jump distance. Unlike CNN, which learns information based on individual data records, RNN can establish relationships between data records by feeding back the learning of the previous learning to the current learning, so that the temporal features in the input data can be captured. However, the simple feedback used in traditional RNNs may accumulate learning errors in long-term dependencies. The accumulated errors may become large enough to invalidate the final learning results. LSTM is a gated recurrent neural network that alleviates such problems. It controls feedback through a set of gate functions so that short-term errors are eventually eliminated and only persistent features are retained. Therefore, LSTM is used for RNN. LSTM can be abstracted as a connection of four subnetworks, a set of control gates and a memory component. The input and output values ​​in the figure are vectors of the same size determined by the input x(t). The state s(t) stored in the memory serves as feedback for the current learning, which is specifically expressed as follows: s(t) = b + U × x(t) + W × h(t-1), where x(t), h(t-1), b, and U are the input at time t, the output at time t-1, the bias, and the weight matrix, respectively. Using the subnet (p(t), g(t), f(t), q(t)), the feedback s(t) from previous learning and the current output h(t) are determined through two types of control gates (α, tanh), namely the forget gate and the input gate. It is specifically expressed as follows: s(t) = σ(f(t))*s(t-1)+σ(p(t))*tanhg(t), h(t) = tanhs(t)*σ(q(t)). LSTM learns the input by adjusting the weights and σ values ​​in these networks so that the temporal features between the input data can be effectively generated in the output.

[0090] The fusion unit 30 is used to perform the fusion step, fuse the above-mentioned sample space features and the above-mentioned sample time features to obtain fused feature data, and input the above-mentioned fused feature data into the attention mechanism layer of the above-mentioned network intrusion detection model to use the above-mentioned attention mechanism layer to re-extract features to obtain sample target feature data. The above-mentioned attention mechanism layer is used to assign different weights to the above-mentioned sample space features and the above-mentioned sample time features in the above-mentioned fused feature data.

[0091] Specifically, the features extracted by CNN, GatedTCN and RNN are fused to obtain fused features. In order to better express useful input information, Self-vtattention is introduced to assign different weights to the fused features, so that the spatial and temporal features of the data can be effectively extracted. The introduction of the attention mechanism can select more important parts from a large amount of information, which is conducive to improving the accuracy of intrusion detection, because self-attention can reduce the influence of external information and perform secondary feature extraction to select important feature information.

[0092] The output unit 40 is used to execute the output step, reshape the above-mentioned sample target feature data through the dimension reshaping layer of the above-mentioned network intrusion detection model, and output the corresponding sample traffic data type through the fully connected layer of the above-mentioned network intrusion detection model.

[0093] Specifically, in order to ensure that the input of each layer in the network intrusion detection model is in the expected input format, it is necessary to use the dimension reshaping layer to reshape the above sample target feature data, and reshape the output of the previous layer to meet the input data dimension of the current layer. Finally, the fully connected layer is used to output the result of the model. The result of the model is the above sample traffic data type.

[0094] The verification unit 50 is used to execute the verification step, perform model verification based on all the above-mentioned sample traffic data types to obtain model accuracy. The above-mentioned model verification at least includes calculating the accuracy, detection rate and false alarm rate of the above-mentioned network intrusion detection model for intrusion detection. The above-mentioned model accuracy at least includes the above-mentioned accuracy, detection rate and false alarm rate.

[0095] Specifically, the network intrusion detection model is evaluated based on the verification accuracy (ACC), detection rate (DR) and false positive rate (FPR).

[0096] The repeating unit 60 is used to adjust all parameters in the above-mentioned network intrusion detection model when the accuracy of the above-mentioned model does not meet the accuracy requirements, and repeat the above-mentioned first extraction step, the above-mentioned second extraction step, the above-mentioned fusion step, the above-mentioned output step and the above-mentioned verification step at least once until the accuracy of the above-mentioned model meets the above-mentioned accuracy requirements, thereby obtaining a target network intrusion detection model.

[0097] Specifically, when any one of the accuracy (ACC), detection rate (DR) and false alarm rate (FPR) does not meet the requirements, all parameters in the above network intrusion detection model are adjusted, and the network intrusion detection model is retrained until the accuracy of the above model meets the above accuracy requirements, thereby obtaining the target network intrusion detection model.

[0098] The real-time detection unit 70 is used to obtain network traffic data in real time, and input the network traffic data into the target network intrusion detection model to output the real-time traffic data type.

[0099] Specifically, after the network intrusion detection model is trained, it can be deployed on the system for real-time detection, and the current network traffic data can be obtained in real time. The above network traffic data is input into the above target network intrusion detection model, and the current real-time traffic data type is output to determine whether the current real-time traffic data type is abnormal traffic or normal traffic.

[0100] The processing unit 80 is used to perform exception processing when the type of the real-time traffic data is abnormal traffic.

[0101] Specifically, when the type of the real-time traffic data is abnormal traffic, it indicates that the current network has been invaded or attacked, and the abnormal network needs to be processed.

[0102] In this embodiment, by integrating CNN, Gated TCN and RNN subnets, and adding an attention mechanism layer after them, finally learning synchronously in multiple steps. Since CNN can extract high-level features from a large amount of data, CNN is placed before GatedTCN and RNN networks. The CNN output will still retain the time information, which is then captured by the Gated TCN and RNN networks. Finally, the attention mechanism layer can use the attention mechanism to "dynamically" generate weights for different connections, so it can be used to process variable-length input sequences. As the data processing proceeds to the next step, the learning granularity becomes finer. By integrating learning in this way, CNN, RNN, Gated TCN and attention mechanism layers can fully learn without interfering with each other. The present application solves the problem of low accuracy of network intrusion detection in the prior art, which results in the failure to combine temporal features and spatial features to extract important feature information during network intrusion detection.

[0103] In order to improve the efficiency of deep learning, in an optional implementation manner, the device further includes:

[0104] An acquisition unit, used for acquiring a sample data set before sequentially inputting input data in a plurality of sets of current training data into a convolutional neural network layer of a network intrusion detection model to extract spatial features of the training data using the convolutional neural network layer to obtain sample spatial features;

[0105] A classification conversion unit, used to perform classification feature conversion on all data in the sample data set to obtain initial sample network traffic data, so that the initial sample network traffic data meets the input format requirements of the convolutional neural network layer;

[0106] The standardization unit is used to standardize the above-mentioned initial sample network traffic data to obtain the above-mentioned sample network traffic data, and the mean value and standard deviation of the above-mentioned sample network traffic data are zero and 1.

[0107] In the above embodiment, the evaluation of the neural network model design is closely related to the data set used. In order to ensure the effectiveness of the evaluation, a non-redundant data set UNSW-NB15 is selected. UNSW-NB15 was generated in 2015. For the data set, attack samples were first collected from three real-world websites: CVE (Common Vulnerabilities and Exposures), BID (Symantec Corporation) and MSD (Microsoft Security Bulletin), and then sample attacks were simulated in a laboratory environment to generate a data set. There are nine attack categories in the UNSW-NB15 data set: DoS, Exploits, Generic, Shellcode, Reconnaissance, Backdoor, Worms, Analysis and Fuzzers. After obtaining the sample data set, the input data needs to be made to conform to the input format required by the neural network, and the original network traffic data includes some classification features. Text information cannot be processed by the deep learning algorithm and needs to be converted into numerical values ​​to obtain the initial sample network traffic data. Therefore, it can be converted by using the "get dummies" function in Pandas. The input data may have different distributions with different means and standard derivatives, which may affect the learning efficiency, therefore, standardization will be applied to scale the initial sample network traffic data so that the initial sample network traffic data has a mean of 0 and a standard deviation of 1.

[0108] In order to extract spatial features while retaining temporal features, in an optional implementation, the first extraction unit includes:

[0109] A convolution module, which converts the sample network flow data in the current training data into a first feature map through a set of filters, wherein the first feature map is the spatial features initially extracted from the sample network flow data;

[0110] A linear transformation module performs a nonlinear transformation on the first feature map using an activation function to obtain a second feature map;

[0111] The pooling module performs a pooling operation on the second feature map to obtain the sample space feature, and the pooling operation is used to reduce the spatial dimension of the second feature map.

[0112] In the above embodiment, CNN mainly consists of two operations: convolution and pooling. Convolution transforms input data into output that highlights the characteristics of the input data through a set of filters or kernels, so the output is usually called a feature map. The convolution output is further processed by an activation function and then downsampled by pooling to remove irrelevant data. Pooling also helps to eliminate failures in the data to improve the learning of subsequent layers. CNN automatically adjusts the filters to learn the input data through rounds of learning process so that its output feature map can effectively represent the original input data. Since network packets exist in one-dimensional form, the one-dimensional convolution is represented as follows: Among them, i represents the position of each value in the input data (i.e., the sample network traffic data mentioned above), g(j) represents the different distribution values ​​of the j-th value in the above input data, j represents the necessary parameter variable of the convolution formula, which is used to specify the range of convolution, m represents the size of the filter, f represents the filter, and ReLU can be selected as the activation function.

[0113] In order to reduce covariance shift and improve the stability of learning results, in an optional implementation manner, the device further includes:

[0114] The normalization unit is used to input the sample space feature into the gated temporal convolutional network layer of the network intrusion detection model to extract the time feature of the sample space feature by using the gated temporal convolutional network layer to obtain the sample time feature, and then perform batch normalization processing on the sample space feature according to the first formula to obtain the normalized sample space feature. The first formula is: The normalized sample space feature x is the sample space feature before adjustment, μ B represents the mean, δ B represents the variance, ε is a negligible value used to ensure that the denominator in the formula is not zero;

[0115] An adjustment unit is used to calculate the normalized sample space feature using the second formula to obtain the adjusted sample space feature, so as to input the adjusted sample space feature into the gated temporal convolutional network layer. The second formula is: Both β and γ are trainable parameters.

[0116] In the above embodiment, one problem with using a deep neural network is that the input value range changes dynamically layer by layer during training, which is also called covariance shift. Covariance shift causes the learning efficiency of one layer to depend on other layers, making the learning results unstable. In addition, due to covariance shift, the learning rate may be limited to a lower value to ensure that data in different input ranges is effectively learned, which slows down the learning speed. Therefore, Batch Normalization is used to solve this problem. Batch Normalization can be used to adjust the CNN output in the RNN module, as shown in the first formula: Based on normalization Normalization results in the output shown in the second formula, where both β and γ are trained during the learning process to obtain better learning results.

[0117] In order to improve the accuracy of intrusion detection, in an optional implementation manner, the fusion unit includes:

[0118] A first calculation module multiplies the fused feature data with three different linear matrices to obtain a query vector matrix, a key vector matrix and a value vector matrix, respectively. The query vector matrix is ​​used to represent the position of the data features in the fused feature data, the key vector matrix represents the correlation between the current data features and other data features, and the value vector matrix represents the data features;

[0119] The second calculation module calculates the weight of each of the above data features in the above fusion feature data according to the third formula. The above third formula is: Attention(Q, K, V) represents the above weights, Q represents the above query vector moment, K represents the above key vector matrix, V represents the value vector matrix, T represents the probability distribution, The vector dimension F represents the query vector moment Q above k The square root of

[0120] The first determination module selects the data features corresponding to the weights greater than the weight threshold and determines them as the sample target feature data.

[0121] In the above embodiment, the combination of CNN, Gated TCN and LSTM network can use CNN for spatial feature extraction and LSTM for time series prediction. The introduction of attention mechanism can select more important parts from a large amount of information, which is conducive to improving the accuracy of intrusion detection. Because self-attention can reduce the influence of external information, the self-attention layer can use the attention mechanism to "dynamically" generate weights of different connections, so it can be used to process variable-length input sequences and can be used as a layer in a neural network. As shown in the third formula, first calculate the dot product of Q and K, and then divide by To prevent the result from being too large, the Softmax operation is used to normalize the result into a probability distribution, and finally multiplied by the matrix V to obtain the weight. The whole process can be understood as dynamically assigning weights to each value vector based on the correlation between the query vector and other key vectors, thereby achieving adaptive attention and feature extraction of the input sequence, and selecting data features with higher weights as the target feature data, that is, the sample feature data mentioned above. This can capture the dependencies between different positions in the input sequence and can handle variable-length input sequences. In practical applications, the attention mechanism layer can be used as a layer in a neural network and used alternately with other layers to improve the model's ability to process sequence data. The attention mechanism layer is Figure 4 Self-Attention in .

[0122] In order to improve the generalization ability of the network intrusion detection model, in an optional implementation manner, the output unit includes:

[0123] A second determination module determines a target output dimension, where the target output dimension is the input dimension of a next layer of the dimension reshaping layer;

[0124] A reshaping module performs a reshaping operation on the sample target feature data according to the target output dimension to rearrange the elements of the sample target feature data to obtain sample flow data;

[0125] The generation module processes the sample flow data through the fully connected layer to generate the sample flow data type.

[0126] In the above embodiment, since the learning granularity in the network intrusion detection model changes after the output of the CNN+RNN layer, the output size of one level is different from the expected input size of the next level. Therefore, a Dimension Reshape layer is added to adjust the dimension of the data to reshape the input data of the next layer. In addition, a typical problem when using deep neural network learning is overfitting, so it is handled by Dropout. Dropout is a regularization technique that reduces the overfitting problem of the model by randomly discarding the connection of neurons with a certain probability during the training process, which can make the network intrusion detection model more robust and more generalizable. Dropout randomly removes some connections from the deep neural network to reduce overfitting. Finally, an additional convolutional layer and a global average pooling layer are used to further extract spatiotemporal features, and the final learning output is generated by the last fully connected layer, that is, the above sample traffic data is processed by the above fully connected layer to generate the above sample traffic data type.

[0127] In order to accurately evaluate the network intrusion detection model, in an optional implementation, the verification unit includes:

[0128] The third calculation module calculates the accuracy using the fourth formula according to all the sample flow data types. The fourth formula is: ACC represents the above accuracy, TP is the number of attacks actually received by the network, TN is the number of correctly classified normal traffic, FP is the number of normal traffic that is actually classified as abnormal traffic, and FN is the number of attacks that are incorrectly classified as normal traffic.

[0129] The fourth calculation module calculates the detection rate using the fifth formula according to all the above sample flow data types. The fifth formula is: DR is the above detection rate, which is used to indicate the detection capability of the above network intrusion detection model;

[0130] The fifth calculation module calculates the false alarm rate using the sixth formula according to all the above sample traffic data types. The sixth formula is: FPR is the false alarm rate mentioned above;

[0131] A third determination module determines that the network intrusion detection model meets the accuracy requirement when the accuracy is greater than or equal to the first threshold, the detection rate is greater than or equal to the second threshold, and the false alarm rate is greater than or equal to the third threshold;

[0132] The fourth determination module determines that the network intrusion detection model does not meet the accuracy requirement when the accuracy is less than the first threshold, the detection rate is less than the second threshold, or the false alarm rate is less than the third threshold.

[0133] In the above embodiment, the network intrusion detection model is evaluated based on verification accuracy (ACC), detection rate (DR) and false alarm rate (FPR). ACC measures the ability of the network intrusion detection model to correctly predict normal traffic that is attacked and not attacked, while DR represents its ability to predict only attacks. A high DR may be masked by a high false alarm rate (FPR), so it needs to be considered together with the DR. The specific calculation formulas are as shown in the fourth formula, the fifth formula and the sixth formula. When any one of the above accuracy, the above detection rate or the above false alarm rate does not meet the accuracy requirement, it is determined that the above network intrusion detection model does not meet the above accuracy requirement, and the network intrusion detection model needs to be retrained.

[0134] The above-mentioned network intrusion detection device based on deep learning includes a processor and a memory. The above-mentioned units are stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions. The above-mentioned modules are all located in the same processor; or, the above-mentioned modules are located in different processors in any combination.

[0135] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the kernel parameters can be adjusted to solve the problem of low accuracy of network intrusion detection caused by failure to combine time features and space features to extract important feature information during network intrusion detection in the prior art.

[0136] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0137] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the deep learning-based network intrusion detection method.

[0138] An embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes the deep learning-based network intrusion detection method when it is running.

[0139] An embodiment of the present invention provides a network intrusion detection system, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, at least the following steps are implemented:

[0140] Step S201, a first extraction step, sequentially inputting input data in multiple groups of current training data into the convolutional neural network layer of the network intrusion detection model, so as to use the convolutional neural network layer to extract the spatial features of the training data to obtain sample spatial features, wherein the current training data is any group of training data in the training data set, and the training data set includes multiple groups of the training data, each group of the training data includes the input data and output data, the input data is sample network traffic data, the output data is the sample traffic data type corresponding to the sample network traffic data, and the sample traffic data type includes abnormal traffic and normal traffic;

[0141] Step S202, a second extraction step, inputting the sample space feature into the gated temporal convolutional network layer of the network intrusion detection model, so as to extract the temporal feature of the sample space feature by using the gated temporal convolutional network layer to obtain the sample temporal feature;

[0142] Step S203, a fusion step, fusing the sample space feature and the sample time feature to obtain fused feature data, and inputting the fused feature data into the attention mechanism layer of the network intrusion detection model to re-extract features using the attention mechanism layer to obtain sample target feature data, wherein the attention mechanism layer is used to assign different weights to the sample space feature and the sample time feature in the fused feature data;

[0143] Step S204, an output step, reshaping the sample target feature data through the dimension reshaping layer of the network intrusion detection model, and outputting the corresponding sample traffic data type through the fully connected layer of the network intrusion detection model;

[0144] Step S205, a verification step, performing model verification according to all the above sample traffic data types to obtain model accuracy, wherein the above model verification at least includes calculating the accuracy, detection rate and false alarm rate of the above network intrusion detection model for intrusion detection, and the above model accuracy at least includes the above accuracy, detection rate and false alarm rate;

[0145] Step S206, when the accuracy of the above-mentioned model does not meet the accuracy requirement, all parameters in the above-mentioned network intrusion detection model are adjusted, and the above-mentioned first extraction step, the above-mentioned second extraction step, the above-mentioned fusion step, the above-mentioned output step and the above-mentioned verification step are repeatedly performed at least once, until the accuracy of the above-mentioned model meets the above-mentioned accuracy requirement, and the target network intrusion detection model is obtained;

[0146] Step S207, acquiring network traffic data in real time, and inputting the network traffic data into the target network intrusion detection model, and outputting a real-time traffic data type;

[0147] Step S208: When the type of the real-time traffic data is abnormal traffic, perform abnormal processing.

[0148] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing at least the following method steps:

[0149] Step S201, a first extraction step, sequentially inputting input data in multiple groups of current training data into the convolutional neural network layer of the network intrusion detection model, so as to use the convolutional neural network layer to extract the spatial features of the training data to obtain sample spatial features, wherein the current training data is any group of training data in the training data set, and the training data set includes multiple groups of the training data, each group of the training data includes the input data and output data, the input data is sample network traffic data, the output data is the sample traffic data type corresponding to the sample network traffic data, and the sample traffic data type includes abnormal traffic and normal traffic;

[0150] Step S202, a second extraction step, inputting the sample space feature into the gated temporal convolutional network layer of the network intrusion detection model, so as to extract the temporal feature of the sample space feature by using the gated temporal convolutional network layer to obtain the sample temporal feature;

[0151] Step S203, a fusion step, fusing the sample space feature and the sample time feature to obtain fused feature data, and inputting the fused feature data into the attention mechanism layer of the network intrusion detection model to re-extract features using the attention mechanism layer to obtain sample target feature data, wherein the attention mechanism layer is used to assign different weights to the sample space feature and the sample time feature in the fused feature data;

[0152] Step S204, an output step, reshaping the sample target feature data through the dimension reshaping layer of the network intrusion detection model, and outputting the corresponding sample traffic data type through the fully connected layer of the network intrusion detection model;

[0153] Step S205, a verification step, performing model verification according to all the above sample traffic data types to obtain model accuracy, wherein the above model verification at least includes calculating the accuracy, detection rate and false alarm rate of the above network intrusion detection model for intrusion detection, and the above model accuracy at least includes the above accuracy, detection rate and false alarm rate;

[0154] Step S206, when the accuracy of the above-mentioned model does not meet the accuracy requirement, all parameters in the above-mentioned network intrusion detection model are adjusted, and the above-mentioned first extraction step, the above-mentioned second extraction step, the above-mentioned fusion step, the above-mentioned output step and the above-mentioned verification step are repeatedly performed at least once, until the accuracy of the above-mentioned model meets the above-mentioned accuracy requirement, and the target network intrusion detection model is obtained;

[0155] Step S207, acquiring network traffic data in real time, and inputting the network traffic data into the target network intrusion detection model, and outputting a real-time traffic data type;

[0156] Step S208: When the type of the real-time traffic data is abnormal traffic, perform abnormal processing.

[0157] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0158] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0159] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0160] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0161] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0162] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0163] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0164] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0165] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0166] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0167] 1) The network intrusion detection method based on deep learning of the present application integrates CNN, Gated TCN and RNN subnets, and adds an attention mechanism layer after them, and finally learns synchronously in multiple steps. Since CNN can extract high-level features from a large amount of data, CNN is placed before Gated TCN and RNN networks. The CNN output will still retain the time information, which is then captured by the Gated TCN and RNN networks. Finally, the attention mechanism layer can use the attention mechanism to "dynamically" generate weights for different connections, so it can be used to process variable-length input sequences. As the data processing proceeds to the next step, the learning granularity becomes finer. By integrating learning in this way, CNN, RNN, Gated TCN and attention mechanism layers can fully learn without interfering with each other. The present application solves the problem of low accuracy of network intrusion detection in the prior art, which results in the failure to combine temporal features and spatial features to extract important feature information during network intrusion detection.

[0168] 2) The network intrusion detection device based on deep learning of the present application integrates CNN, Gated TCN and RNN subnets, and adds an attention mechanism layer after them, and finally learns synchronously in multiple steps. Since CNN can extract high-level features from a large amount of data, CNN is placed before Gated TCN and RNN networks. The CNN output will still retain the time information, which is then captured by the Gated TCN and RNN networks. Finally, the attention mechanism layer can use the attention mechanism to "dynamically" generate weights for different connections, so it can be used to process variable-length input sequences. As the data processing proceeds to the next step, the learning granularity becomes finer. By integrating learning in this way, CNN, RNN, Gated TCN and attention mechanism layers can fully learn without interfering with each other. The present application solves the problem of low accuracy of network intrusion detection in the prior art, which results in the failure to combine temporal features and spatial features to extract important feature information during network intrusion detection.

[0169] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A network intrusion detection method based on deep learning, characterized in that: include: The first extraction step is to sequentially input the input data in the multiple sets of current training data into the convolutional neural network layer of the network intrusion detection model, so as to use the convolutional neural network layer to extract the spatial features of the training data and obtain the sample spatial features, wherein the current training data is any set of training data in the training data set, and the training data set includes multiple sets of the training data, each set of the training data includes the input data and output data, the input data is sample network traffic data, the output data is the sample traffic data type corresponding to the sample network traffic data, and the sample traffic data type includes abnormal traffic and normal traffic; The second extraction step is to input the sample space feature into the gated temporal convolutional network layer of the network intrusion detection model, so as to extract the time feature of the sample space feature by using the gated temporal convolutional network layer to obtain the sample time feature; A fusion step, fusing the sample space feature and the sample time feature to obtain fused feature data, and inputting the fused feature data into the attention mechanism layer of the network intrusion detection model to re-extract features using the attention mechanism layer to obtain sample target feature data, wherein the attention mechanism layer is used to assign different weights to the sample space feature and the sample time feature in the fused feature data; An output step, reshaping the sample target feature data through a dimension reshaping layer of the network intrusion detection model, and outputting the corresponding sample traffic data type through a fully connected layer of the network intrusion detection model; A verification step, performing model verification according to all the sample traffic data types to obtain model accuracy, wherein the model verification at least includes calculating the accuracy, detection rate and false alarm rate of the network intrusion detection model for intrusion detection, and the model accuracy at least includes the accuracy, detection rate and false alarm rate; In the case where the model accuracy does not meet the accuracy requirement, all parameters in the network intrusion detection model are adjusted, and the first extraction step, the second extraction step, the fusion step, the output step and the verification step are repeatedly performed at least once until the model accuracy meets the accuracy requirement, thereby obtaining a target network intrusion detection model; Acquire network traffic data in real time, input the network traffic data into the target network intrusion detection model, and output the real-time traffic data type; When the real-time traffic data type is abnormal traffic, abnormal processing is performed.

2. The method according to claim 1, characterized in that Before sequentially inputting the input data in the multiple sets of current training data into the convolutional neural network layer of the network intrusion detection model to extract the spatial features of the training data using the convolutional neural network layer to obtain the sample spatial features, the method further includes: Get a sample dataset; Performing classification feature conversion on all data in the sample data set to obtain initial sample network traffic data, so that the initial sample network traffic data meets the input format requirements of the convolutional neural network layer; The initial sample network traffic data is standardized to obtain the sample network traffic data, wherein the mean value of the sample network traffic data is zero and the standard deviation is 1.

3. The method according to claim 1, characterized in that Inputting the input data in the multiple sets of current training data into the convolutional neural network layer of the network intrusion detection model in sequence, so as to extract the spatial features of the training data by using the convolutional neural network layer to obtain the sample spatial features, including: Converting the sample network traffic data in the current training data into a first feature map through a set of filters, wherein the first feature map is the spatial features initially extracted from the sample network traffic data; Performing a nonlinear transformation on the first feature map using an activation function to obtain a second feature map; A pooling operation is performed on the second feature map to obtain the sample space feature, where the pooling operation is used to reduce the spatial dimension of the second feature map.

4. The method according to claim 1, characterized in that: Before inputting the sample space feature into the gated temporal convolutional network layer of the network intrusion detection model to extract the temporal feature of the sample space feature using the gated temporal convolutional network layer to obtain the sample temporal feature, the method further includes: The sample space features are batch normalized according to a first formula to obtain normalized sample space features. The first formula is: The normalized sample space feature x is the sample space feature before adjustment, μ B represents the mean, δ B represents the variance, ε is a negligible value used to ensure that the denominator in the formula is not zero; The normalized sample space feature is calculated using the second formula to obtain the adjusted sample space feature, so as to input the adjusted sample space feature into the gated temporal convolutional network layer. The second formula is: Both β and γ are trainable parameters.

5. The method according to claim 1, characterized in that The fused feature data is input into the attention mechanism layer of the network intrusion detection model to re-extract features using the attention mechanism layer to obtain sample target feature data, including: Multiplying the fused feature data with three different linear matrices to obtain a query vector matrix, a key vector matrix and a value vector matrix, respectively, wherein the query vector matrix is ​​used to represent the position of the data features in the fused feature data, the key vector matrix represents the correlation between the current data features and other data features, and the value vector matrix represents the data features; The weight of each data feature in the fused feature data is calculated according to a third formula, and the third formula is: Attention(Q,K,V) represents the weight, Q represents the query vector matrix, K represents the key vector matrix, V represents the value vector matrix, T represents the probability distribution, The vector dimension F represents the query vector moment Q k The square root of The data feature corresponding to the weight being greater than the weight threshold is selected and determined as the sample target feature data.

6. The method according to claim 1, characterized in that The sample target feature data is reshaped by the dimension reshaping layer of the network intrusion detection model, and the corresponding sample traffic data type is output by the fully connected layer of the network intrusion detection model, including: Determine a target output dimension, where the target output dimension is an input dimension of a next layer of the dimension reshaping layer; Performing a reshaping operation on the sample target feature data according to the target output dimension to rearrange elements of the sample target feature data to obtain sample flow data; The sample traffic data is processed through the fully connected layer to generate the sample traffic data type.

7. The method according to claim 1, characterized in that Model validation operations are performed based on all of the sample flow data types to obtain model accuracy, including: The accuracy is calculated using a fourth formula based on all the sample flow data types. The fourth formula is: ACC represents the accuracy, TP is the number of attacks actually received by the network, TN is the number of correctly classified normal traffic, FP is the number of actually normal traffic but misclassified as abnormal traffic, and FN is the number of attacks misclassified as normal traffic; The detection rate is calculated using the fifth formula according to all the sample flow data types. The fifth formula is: DR is the detection rate, which is used to indicate the detection capability of the network intrusion detection model; The false alarm rate is calculated using the sixth formula according to all the sample traffic data types. The sixth formula is: FPR is the false alarm rate; In the case where the accuracy is greater than or equal to a first threshold, the detection rate is greater than or equal to a second threshold, and the false alarm rate is greater than or equal to a third threshold, determining that the network intrusion detection model meets the accuracy requirement; When the accuracy is less than the first threshold, or the detection rate is less than the second threshold, or the false alarm rate is less than the third threshold, it is determined that the network intrusion detection model does not meet the accuracy requirement.

8. A network intrusion detection device based on deep learning, characterized in that: The device comprises: A first extraction unit is used to perform a first extraction step, inputting input data in multiple groups of current training data into the convolutional neural network layer of the network intrusion detection model in sequence, so as to use the convolutional neural network layer to extract the spatial features of the training data to obtain sample spatial features, wherein the current training data is any group of training data in a training data set, the training data set includes multiple groups of training data, each group of training data includes the input data and output data, the input data is sample network traffic data, the output data is a sample traffic data type corresponding to the sample network traffic data, and the sample traffic data type includes abnormal traffic and normal traffic; A second extraction unit is used to perform a second extraction step, input the sample space feature into the gated temporal convolutional network layer of the network intrusion detection model, so as to extract the time feature of the sample space feature by using the gated temporal convolutional network layer to obtain the sample time feature; A fusion unit, used for performing a fusion step, fusing the sample space feature and the sample time feature to obtain fused feature data, and inputting the fused feature data into the attention mechanism layer of the network intrusion detection model, so as to facilitate the attention mechanism layer to re-extract features and obtain sample target feature data, wherein the attention mechanism layer is used to assign different weights to the sample space feature and the sample time feature in the fused feature data; An output unit, used to perform an output step, reshape the sample target feature data through a dimension reshaping layer, and output the sample flow data type through a fully connected layer; A verification unit, configured to execute a verification step, perform model verification according to all the sample traffic data types, and obtain model accuracy, wherein the model verification at least includes calculating the accuracy, detection rate, and false alarm rate of the network intrusion detection model for intrusion detection, and the model accuracy at least includes the accuracy, detection rate, and false alarm rate; A repeating unit, used for adjusting all parameters in the network intrusion detection model when the model accuracy does not meet the accuracy requirement, and repeatedly performing the first extraction step, the second extraction step, the fusion step, the output step and the verification step at least once until the model accuracy meets the accuracy requirement, thereby obtaining a target network intrusion detection model; A real-time detection unit, used for acquiring network flow data in real time, and inputting the network flow data into the target network intrusion detection model, and outputting a real-time flow data type; The processing unit is used to perform exception processing when the real-time traffic data type is abnormal traffic.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images